2 ms·
Are the /AA and /ObjStm items a concerning indicator? This is the limit of my familiarity with pdf-id: ＄> python2.7 pdfid.py The_AWK_Programming_Langua
by banku_brougham 10y ago
Are the /AA and /ObjStm items a concerning indicator? This is the limit of my familiarity with pdf-id:
＄> python2.7 pdfid.py The_AWK_Programming_Language.pdf
PDFiD 0.2.1 The_AWK_Programming_Language.pdf
PDF Header: %PDF-1.6
..
/Page 0
/Encrypt 0
/ObjStm 7
/JS 0
/JavaScript 0
/AA 1
/OpenAction 0
/AcroForm 0
/JBIG2Decode 222
...
It has /AA which is an automatic load action, and it has a lot of objects which could contain javascript, would need closer scrutiny I think.
- banku_brougham 10y agoI posted the above to prompt explanation from someone with expertise in pdf malware to validate the safety of the linked pdf. I'm concerned that it has open actions and objects that could be used to obfuscate js code. The author of pdf-id flags these attributes as requiring further inspection. Wouldn't a tech pdf of a popular book that is impossible to obtain legally in digital form be an excellent vector to deliver malware to tech users with probably lots of stored credentials to resources?